linux-toradex.git/net/netfilter, branch v2.6.27.14

netfilter: xt_iprange: fix range inversion match

2008-10-25T21:32:40+00:00

netfilter: xt_iprange: fix range inversion match

Upstream commit 6def1eb48:

Inverted IPv4 v1 and IPv6 v0 matches don't match anything since 2.6.25-rc1!

Signed-off-by: Alexey Dobriyan 
Acked-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

netfilter: nf_conntrack_irc: make sure string is terminated before calling simple_strtoul

2008-09-08T01:21:24+00:00

Alexey Dobriyan points out:

1. simple_strtoul() silently accepts all characters for given base even
   if result won't fit into unsigned long. This is amazing stupidity in
   itself, but

2. nf_conntrack_irc helper use simple_strtoul() for DCC request parsing.
   Data first copied into 64KB buffer, so theoretically nothing prevents
   reading past the end of it, since data comes from network given 1).

This is not actually a problem currently since we're guaranteed to have
a 0 byte in skb_shared_info or in the buffer the data is copied to, but
to make this more robust, make sure the string is actually terminated.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: nf_conntrack_gre: nf_ct_gre_keymap_flush() fixlet

2008-09-08T01:20:36+00:00

It does "kfree(list_head)" which looks wrong because entity that was
allocated is definitely not list_head.

However, this all works because list_head is first item in
struct nf_ct_gre_keymap.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: nf_conntrack_gre: more locking around keymap list

2008-09-08T01:20:08+00:00

gre_keymap_list should be protected in all places.
(unless I'm misreading something)

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: nf_conntrack_sip: de-static helper pointers

2008-09-08T01:19:25+00:00

Helper's ->help hook can run concurrently with itself, so iterating over
SIP helpers with static pointer won't work reliably.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: ctnetlink: sleepable allocation with spin lock bh

2008-08-19T04:31:46+00:00

This patch removes a GFP_KERNEL allocation while holding a spin lock with
bottom halves disabled in ctnetlink_change_helper().

This problem was introduced in 2.6.23 with the netfilter extension
infrastructure.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: ctnetlink: fix sleep in read-side lock section

2008-08-19T04:31:24+00:00

Fix allocation with GFP_KERNEL in ctnetlink_create_conntrack() under
read-side lock sections.

This problem was introduced in 2.6.25.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netfilter: ctnetlink: fix double helper assignation for NAT'ed conntracks

2008-08-19T04:30:55+00:00

If we create a conntrack that has NAT handlings and a helper, the helper
is assigned twice. This happens because nf_nat_setup_info() - via
nf_conntrack_alter_reply() - sets the helper before ctnetlink, which
indeed does not check if the conntrack already has a helper as it thinks that
it is a brand new conntrack.

The fix moves the helper assignation before the set of the status flags.
This avoids a bogus assertion in __nf_ct_ext_add (if netfilter assertions are
enabled) which checks that the conntrack must not be confirmed.

This problem was introduced in 2.6.23 with the netfilter extension
infrastructure.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy

netfilter: fix two recent sysctl problems

2008-08-06T09:35:44+00:00

Starting with 9043476f726802f4b00c96d0c4f418dde48d1304 ("[PATCH]
sanitize proc_sysctl") we have two netfilter releated problems:

 - WARNING: at kernel/sysctl.c:1966 unregister_sysctl_table+0xcc/0x103(),
   caused by wrong order of ini/fini calls

 - net.netfilter is duplicated and has truncated set of records

Thanks to very useful guidelines from Al Viro, this patch fixes both
of them.

Signed-off-by: Krzysztof Piotr Oledzki 
Acked-by: Al Viro 
Signed-off-by: David S. Miller

netfilter: xt_hashlimit: fix race between htable_destroy and htable_gc

2008-07-31T07:38:52+00:00

Deleting a timer with del_timer doesn't guarantee, that the
timer function is not running at the moment of deletion. Thus
in the xt_hashlimit case we can get into a ticklish situation
when the htable_gc rearms the timer back and we'll actually
delete an entry with a pending timer.

Fix it with using del_timer_sync().

AFAIK del_timer_sync checks for the timer to be pending by
itself, so I remove the check.

Signed-off-by: Pavel Emelyanov 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller